CCSK cloud

CCSK
COURSE
1: Architecture
?
NIST Definitions
?
Essential Characteristics
?
Service Models
?
Deployment Models
?
Multi-Tenancy
?
CSA Cloud Reference Model
?
Jericho Cloud Cube Model
?
Cloud Security Reference Model
?
Cloud Service Brokers
?
Service Level Agreements
2: Governance and Enterprise Risk Management
?
Contractual Security Requirements
?
Enterprise and Information Risk Management
?
Third Party Management Recommendations
?
Supply chain examination
?
Use of Cost Savings for Cloud
3: Legal Issues: Contracts and Electronic Discovery
?
Consideration of cloud-related issues in three dimensions
?
eDiscovery considerations
?
Jurisdictions and data locations
?
Liability for activities of subcontractors
?
Due diligence responsibility
?
Federal Rules of Civil Procedure and electronically stored
information
?
Metadata
?
Litigation hold
4: Compliance and Audit Management
?
Definition of Compliance
?
Right to audit
?
Compliance impact on cloud contracts
?
Audit scope and compliance scope
?
Compliance analysis requirements
?
Auditor requirements
5: Information Management and Data Security
?
Six phases of the Data Security Lifecycle and their key ele
-
ments
?
Volume storage
?
Object storage
?
Logical vs physical locations of data
?
Three valid options for protecting data
?
Data Loss Prevention
?
Detection Data Migration to the Cloud
?
Encryption in IaaS, PaaS & SaaS
?
Database Activity Monitoring and File Activity Monitoring
?
Data Backup
?
Data Dispersion
?
Data Fragmentation
6: Interoperability and Portability
?
Definitions of Portability and Interoperability
?
Virtualization impacts on Portability and Interoperability
?
SAML and WS-Security
?
Size of Data Sets
?
Lock-In considerations by IaaS, PaaS & SaaS delivery models
?
Mitigating hardware compatibility issues
7: Traditional Security, Business Continuity, and Disaster
Recovery
?
Four D’s of perimeter security
?
Cloud backup and disaster recovery services
?
Customer due diligence related to BCM/DR
?
Business Continuity Management/Disaster Recovery due
diligence
?
Restoration Plan
?
Physical location of cloud provider
8: Data Center Operations
?
Relation to Cloud Controls Matrix
?
Queries run by data center operators
?
Technical aspects of a Provider’s data center operations for
customers
?
Logging and report generation in multi-site clouds
9: Incident Response
?
Factor allowing for more efficient and effective containment
and recovery in a cloud
?
Main data source for detection and analysis of an incident
?
Investigating and containing an incident in an Infrastructure
as a Service environment
?
Reducing the occurrence of application level incidents
?
How often should incident response testing occur
?
Offline analysis of potential incidents

10: Application Security
?
Identity, entitlement, and access management (IdEA)
?
SDLC impact and implications
?
Differences in S-P-I models
?
Consideration when performing a remote vulnerability test of a cloud-based application
?
Categories of security monitoring for applications
?
Entitlement matrix
11: Encryption and Key Management
?
Adequate encryption protection of data in the cloud
?
Key management best practices, location of keys, keys per user
?
Relationship to tokenization, masking, anonymization and cloud database controls
12: Identity, Entitlement, and Access Management
?
Relationship between identities and attributes
?
Identity Federation
?
Relationship between Policy Decision Point (PDP) and Policy Enforcement Point (PEP)
?
SAML and WS-Federation
?
Provisioning and authoritative sources
13: Virtualization
?
Security concerns for hypervisor architecture
?
VM guest hardening, blind spots, VM Sprawl, data comingling, instant-on gaps
?
In-Motion VM characteristics that can create a serious complexity for audits
?
How can virtual machine communications bypass network security controls
?
VM attack surfaces
?
Compartmentalization of VMs
14: Security as a Service
?
10 categories
?
Barriers to developing full confidence in security as a service (SECaaS)
?
Deployment of Security as a Service in a regulated industry prior SLA
?
Logging and reporting implications
?
How can web security as a service be deployed
?
What measures do Security as a Service providers take to earn the trust of their customers
?
ENISA Cloud Computing: Benefits, Risks and Recommendations for Information Security
?
Isolation failure
?
Economic Denial of Service
?
Licensing Risks
?
VM hopping
?
Five key legal issues common across all scenarios
?
Top security risks in ENISA research
?
OVF
?
Underlying vulnerability in Loss of Governance
?
User provisioning vulnerability
?
Risk concerns of a cloud provider being acquired
?
Security benefits of cloud